APT / THREAT GROUP

MINIBIKE

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to Mandiant, this is a custom backdoor that provides a more flexible code-execution interface and enhanced reconnaissance features compared to MINIBIKE.

Threat Analysis

MINIBIKE is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.checkpoint.com/research/iranian-threat-actor-nimbus-manticore-expands-campaigns-into-europe-with-advanced-malware-and-fake-job-lures/

→https://catalyst.prodaft.com/public/report/modus-operandi-of-subtle-snail/overview#heading-1000|0

→https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe

→https://www.mandiant.com/resources/blog/suspected-iranian-unc1549-targets-israel-middle-east

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

MINIBIKEwin.minibike

External Intelligence

Malpedia: win.minibike

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search MINIBIKE